T1036.006sub-technique of T1036 Masquerading

Space after Filename

Linux · macOSnothing on this site yetT1036.006 on attack.mitre.org

Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with.app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called `evil.bin`, when it is double clicked by a user, it will launch Terminal.app and execute.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Masquerading via Space After Filename - Behavioral Detection Strategy

Detection of file execution where the file name contains a trailing space to masquerade as a known executable. Adversaries may exploit the way command line interpreters handle file names with trailing whitespace.
Execution of renamed or dropped files with a trailing space to deceive users or analysts, especially in LaunchAgents or LaunchDaemons.

the rest of T1036

T1036.001 Invalid Code Signature · not covered yet
T1036.002 Right-to-Left Override · not covered yet
T1036.003 Rename Legitimate Utilities · not covered yet
T1036.004 Masquerade Task or Service · not covered yet
T1036.005 Match Legitimate Resource Name or Location · not covered yet
T1036.007 Double File Extension · not covered yet
T1036.008 Masquerade File Type · not covered yet
T1036.009 Break Process Trees · not covered yet
T1036.010 Masquerade Account Name · not covered yet
T1036.011 Overwrite Process Arguments · not covered yet
T1036.012 Browser Fingerprint · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.